Abstract: A new model is proposed for improving password security with a heuristic method which tries to find out the password core by reasoning just like a hacker usually does in social engine and then transforms the password core into kinds of passwords to check whether the right one is in them. With this model the design and implementation of an audit tool called PassChecker are described. With this method the PassChecker can improve the efficiency and efficacy of ch ecking weak passwords.

Key words: password security, heuristic strategy, password core, direct clue, indirect clue